CVE-2005-4191
3.5 · LOWMultiple cross-site scripting (XSS) vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web scri…
Overview
CVE-2005-4191 is a low-severity vulnerability affecting horde nag_task_list_manager_h3. It was published on December 13, 2005 and has a CVSS 2.0 base score of 3.5 (LOW).
This vulnerability has a CVSS 2.0 base score of 3.5, rated LOW. It can be exploited remotely over the network. Some level of privileges is required for exploitation.
Technical description
Multiple cross-site scripting (XSS) vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script or HTML via (1) the tasklist's name or (2) description, when creating a new tasklist.
Remediation
Check the references section for vendor advisories and patches from horde. Update nag_task_list_manager_h3 to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|
References
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2005-4191?
CVE-2005-4191 is a low-severity vulnerability affecting horde nag_task_list_manager_h3. It was published on December 13, 2005 and has a CVSS 2.0 base score of 3.5 (LOW).
How severe is CVE-2005-4191?
This vulnerability has a CVSS 2.0 base score of 3.5, rated LOW. It can be exploited remotely over the network. Some level of privileges is required for exploitation.
How do I fix or remediate CVE-2005-4191?
Check the references section for vendor advisories and patches from horde. Update nag_task_list_manager_h3 to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2005-4191?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2005-4191 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related LOW CVEs from 2005
View all- 3.7CVE-2005-0254
BibORB 1.3.2, and possibly earlier versions, does not properly enforce a restriction for uploading o
View details - 3.7CVE-2005-0953
Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary file
View details - 3.7CVE-2005-0988
Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local us
View details - 3.7CVE-2005-1039
Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is runn
View details - 3.7CVE-2005-1751
Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files vi
View details - 3.7CVE-2005-1727
Apple Mac OS X 10.4.x up to 10.4.1 sets insecure world- and group-writable permissions for the (1) s
View details - 3.7CVE-2005-1993
Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry i
View details - 3.7CVE-2005-1768
Race condition in the ia32 compatibility code for the execve system call in Linux kernel 2.4 before
View details - 3.7CVE-2005-2306
Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun
View details - 3.7CVE-2005-4268
Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive, allows local us
View details - 3.7CVE-2005-4667
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code v
View details - 3.7CVE-2005-4780
Cross-site scripting (XSS) vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote att
View details